CVE-2026-75748: Server-Side Request Forgery (SSRF) (CWE-918) in Adobe ColdFusion 2025

CVE-2026-75748 is an SSRF vulnerability in Adobe ColdFusion 2025 that permits an attacker with existing high privileges to perform server-side requests that can lead to privilege escalation by accessing internal resources. Exploitation does not require user interaction, and the vulnerability changes the security scope, increasing the impact. The CVSS 3.1 base score is 7.6, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with high privileges can exploit this SSRF vulnerability to escalate privileges and gain elevated access to internal resources. This could lead to unauthorized access to sensitive data or internal systems. The vulnerability does not require user interaction, increasing the risk of automated or remote exploitation. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict high-privilege access and monitor for suspicious SSRF activity where possible.